Hacker claims to sell data of 2.2 million people on I-CAD, France's pet registry

The animal's name, its microchip number, its date of birth, its sex, and its owner's name. That is what the excerpts posted on October 18 on a cybercrime forum by a hacker calling themself ChimeraZ show. The hacker is offering a database attributed to I-CAD, the national identification registry for dogs, cats and ferrets.

According to the monitoring site FrenchBreaches, the hacker claims the database covers 2.2 million distinct individuals, mostly pet owners, as well as 50,000 veterinarians. Neither I-CAD nor its operator, Ingenium Animalis, which manages the registry on behalf of the Ministry of Agriculture, has confirmed these figures at this stage. FrenchBreaches considers the claim credible but unverified. The same day, ChimeraZ published another archive, presented as coming from Blissim, the beauty box sold online.

What would the pet registry contain?

According to the samples described by FrenchBreaches, owner records combine first and last names, pet names, microchip numbers, dates of birth, spay/neuter status and notes of death. Veterinarian records include an internal ID, full name, département and a professional ID. The excerpts do not clearly show postal addresses, email addresses or phone numbers.

This is not the first warning. In September 2025, Ingenium Animalis spotted a flaw that could have allowed certain records to be queried automatically. The company says it fixed the issue, launched an audit and notified the CNIL (the French data protection authority). The public only learned of it on August 10, 2026, after owners received fraudulent messages. The ministry said at the time that only email addresses were affected, and no definite link has been established with those scams. FrenchBreaches treats the October claim as a separate matter, with no evidence of a new intrusion. The registry lists more than 46 million animals.

At Blissim, bank cards, but not their numbers

For Blissim, ChimeraZ claims a 688 MB archive with 1,916,599 rows tied to payment methods, including 399,236 presented as payments and 97,187 that include the cardholder's name. The hacker speaks of “payment logs.” The term is misleading, according to the analysis published by Cyberattaque.org: the visible fields (name, card brand, last four digits, expiration date, transaction reference) look like payment methods saved for subscriptions. There is no full card number or security code. The same card may appear several times: the number of rows is not a number of customers.

The format resembles that of Adyen, Blissim's payment provider, but nothing indicates that Adyen was compromised: the data could come from the merchant's logs or databases. Blissim has not publicly commented on this claim at this stage.

The alias has been active for several days. According to Journal du Coin, ChimeraZ is also behind the claims targeting the Société centrale canine (1.4 million dog owners claimed), the Grande Loge féminine and Malakoff Humanis, where members' health reimbursements may have leaked through a service provider.

How to protect yourself from the scams that could follow

This data is not enough to empty a bank account. Its value lies in the credibility it gives a scammer: a message quoting your cat's name or the end of your card number looks surely legitimate.

• Be wary of any message or call invoking I-CAD, a veterinarian or Blissim to demand a payment, documents or an “update” of your contact details. Go through the official website, without clicking the link you received.
• Knowing your pet's microchip number or the last four digits of your card does not prove that a caller is legitimate.
• Never share a code received by text message or your banking details with someone who contacted you.
• Monitor your bank statements and report any suspicious transaction to your bank. Scam attempts can be reported on Cybermalveillance.gouv.fr (France's government platform for reporting cybercrime).

One question remains unanswered: where do these files come from? Only responses from I-CAD and Blissim will show whether these are new intrusions or older data put back into circulation.